Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
References
| Link | Resource |
|---|---|
| https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
22 Dec 2025, 15:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723 - Vendor Advisory | |
| CPE | cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:* |
|
| First Time |
Hashicorp
Hashicorp consul |
28 Oct 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-28 21:15
Updated : 2025-12-22 15:55
NVD link : CVE-2025-11375
Mitre link : CVE-2025-11375
CVE.ORG link : CVE-2025-11375
JSON object : View
Products Affected
hashicorp
- consul
CWE
CWE-770
Allocation of Resources Without Limits or Throttling